CORS configuration in Security in Spring Boot - Mini Project: Build & Apply

CORS configuration in Security

📖 Scenario: You are building a Spring Boot web application that will be accessed from a frontend running on a different domain. To allow the frontend to communicate with your backend securely, you need to configure CORS (Cross-Origin Resource Sharing) in your Spring Security setup.

🎯 Goal: Configure CORS in Spring Security to allow requests from http://localhost:3000 with GET and POST methods.

📋 What You'll Learn

Create a CORS configuration bean allowing origin http://localhost:3000

Allow HTTP methods GET and POST in CORS configuration

Integrate the CORS configuration into Spring Security filter chain

Enable CORS support in the security configuration

💡 Why This Matters

🌍 Real World

Many web applications have frontend and backend running on different domains or ports. Configuring CORS properly in Spring Security allows safe cross-origin requests from the frontend to the backend.

💼 Career

Understanding how to configure CORS in Spring Security is essential for backend developers working on secure APIs that serve frontend applications hosted separately.

1

Create CORS configuration bean

Create a method called corsConfigurationSource that returns a CorsConfigurationSource bean. Inside it, create a CorsConfiguration object and set allowed origins to List.of("http://localhost:3000"). Then register this configuration for all paths "/**" using UrlBasedCorsConfigurationSource.

Spring Boot

# Your code here
// Create a method corsConfigurationSource returning CorsConfigurationSource bean

Hint

Use CorsConfiguration and UrlBasedCorsConfigurationSource classes to create the CORS setup.

2

Add allowed HTTP methods to CORS configuration

In the corsConfigurationSource method, add allowed HTTP methods GET and POST to the CorsConfiguration object using setAllowedMethods.

Spring Boot

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.cors.CorsConfiguration;
import org.springframework.web.cors.CorsConfigurationSource;
import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
import java.util.List;

@Configuration
public class SecurityConfig {

    @Bean
    public CorsConfigurationSource corsConfigurationSource() {
        CorsConfiguration configuration = new CorsConfiguration();
        configuration.setAllowedOrigins(List.of("http://localhost:3000"));
        // Add allowed methods GET and POST here
        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        source.registerCorsConfiguration("/**", configuration);
        return source;
    }
}

Hint

Use configuration.setAllowedMethods(List.of("GET", "POST")) to allow these HTTP methods.

3

Configure Spring Security to use CORS

Add a SecurityFilterChain bean method called filterChain that takes HttpSecurity http as a parameter. Inside, enable CORS by calling http.cors(). Then disable CSRF with http.csrf().disable(). Finally, build and return the security filter chain.

Spring Boot

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.cors.CorsConfiguration;
import org.springframework.web.cors.CorsConfigurationSource;
import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
import java.util.List;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
public class SecurityConfig {

    @Bean
    public CorsConfigurationSource corsConfigurationSource() {
        CorsConfiguration configuration = new CorsConfiguration();
        configuration.setAllowedOrigins(List.of("http://localhost:3000"));
        configuration.setAllowedMethods(List.of("GET", "POST"));
        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        source.registerCorsConfiguration("/**", configuration);
        return source;
    }

    // Add SecurityFilterChain bean method filterChain here
    // Enable CORS and disable CSRF
}

Hint

Use http.cors() to enable CORS support in Spring Security.

4

Complete Security Configuration class

Ensure the class is annotated with @Configuration and contains both corsConfigurationSource and filterChain bean methods as shown. This completes the CORS setup integrated with Spring Security.

Spring Boot

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.cors.CorsConfiguration;
import org.springframework.web.cors.CorsConfigurationSource;
import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
import java.util.List;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.web.SecurityFilterChain;

// Ensure class is annotated and contains both bean methods
// Your code here

Hint

Make sure the class has @Configuration and both bean methods.

Practice

1. What is the main purpose of configuring CORS in a Spring Boot security setup?

easy

A. To control which external websites can access your backend resources

B. To improve database query performance

C. To manage user authentication tokens

D. To style the frontend user interface

Solution

1. Step 1: Understand CORS role in web security

   CORS (Cross-Origin Resource Sharing) controls which external domains can call your backend APIs.

2. Step 2: Identify the purpose in Spring Boot security

   Configuring CORS in Spring Security allows safe cross-site requests by specifying allowed origins and methods.

3. Final Answer:

   To control which external websites can access your backend resources -> Option A

4. Quick Check:

   CORS controls access origins = A [OK]

Hint: CORS = Cross-Origin access control [OK]

Common Mistakes:

• Confusing CORS with authentication
• Thinking CORS improves database speed
• Assuming CORS styles frontend

2. Which of the following is the correct way to enable CORS in a Spring Security configuration class?

easy

A. http.corsEnabled(true);

B. http.enableCors();

C. http.allowCors(true);

D. http.cors().and().csrf().disable();

Solution

1. Step 1: Recall Spring Security CORS enabling syntax

   Spring Security uses the method http.cors() to enable CORS support.

2. Step 2: Identify the correct chaining method

   The correct chaining to disable CSRF and enable CORS is http.cors().and().csrf().disable();

3. Final Answer:

   http.cors().and().csrf().disable(); -> Option D

4. Quick Check:

   Enable CORS with http.cors() = C [OK]

Hint: Use http.cors() to enable CORS in Spring Security [OK]

Common Mistakes:

• Using non-existent methods like enableCors()
• Forgetting to chain with .and()
• Confusing CORS enabling with CSRF

3. Given this Spring Security CORS configuration snippet, what origins are allowed?

@Bean
public CorsConfigurationSource corsConfigurationSource() {
  CorsConfiguration configuration = new CorsConfiguration();
  configuration.setAllowedOrigins(List.of("https://example.com", "https://app.example.com"));
  configuration.setAllowedMethods(List.of("GET", "POST"));
  UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
  source.registerCorsConfiguration("/**", configuration);
  return source;
}

medium

A. No origins are allowed because configuration is incomplete

B. Requests from any origin are allowed

C. Only requests from https://example.com and https://app.example.com are allowed

D. Only GET requests from any origin are allowed

Solution

1. Step 1: Analyze allowed origins list

   The code sets allowed origins explicitly to "https://example.com" and "https://app.example.com".

2. Step 2: Understand effect on requests

   Only requests coming from these two origins will be accepted; others will be blocked by CORS policy.

3. Final Answer:

   Only requests from https://example.com and https://app.example.com are allowed -> Option C

4. Quick Check:

   Allowed origins = example.com and app.example.com = D [OK]

Hint: Allowed origins list controls which sites can call backend [OK]

Common Mistakes:

• Assuming all origins allowed by default
• Confusing allowed methods with allowed origins
• Thinking configuration is incomplete without headers

4. Identify the error in this Spring Security CORS configuration code:

@Bean
public CorsConfigurationSource corsConfigurationSource() {
  CorsConfiguration configuration = new CorsConfiguration();
  configuration.setAllowedOrigins("*");
  configuration.setAllowedMethods(List.of("GET", "POST"));
  UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
  source.registerCorsConfiguration("/**", configuration);
  return source;
}

medium

A. Allowed methods list is missing PUT and DELETE

B. setAllowedOrigins expects a list, not a single string

C. UrlBasedCorsConfigurationSource cannot be used here

D. The method should return void, not CorsConfigurationSource

Solution

1. Step 1: Check setAllowedOrigins parameter type

   The method setAllowedOrigins requires a List<String>, but the code passes a single String "*".

2. Step 2: Understand correct usage for wildcard

   To allow all origins, use List.of("*") instead of a plain string.

3. Final Answer:

   setAllowedOrigins expects a list, not a single string -> Option B

4. Quick Check:

   Allowed origins must be List<String> = B [OK]

Hint: setAllowedOrigins needs a list, not a string [OK]

Common Mistakes:

• Passing a string instead of a list to setAllowedOrigins
• Ignoring method parameter types
• Assuming missing HTTP methods cause errors here

5. You want to allow all origins but only GET and POST methods in your Spring Security CORS config. Which code snippet correctly achieves this while following best practices?

hard

A. configuration.setAllowedOriginPatterns(List.of("*")); configuration.setAllowedMethods(List.of("GET", "POST"));

B. configuration.setAllowedOrigins(List.of("*")); configuration.setAllowedMethods(List.of("GET", "POST"));

C. configuration.setAllowedOrigins("*"); configuration.setAllowedMethods(List.of("GET", "POST"));

D. configuration.setAllowedOrigins(List.of("*")); configuration.setAllowedMethods(List.of("GET", "POST", "PUT"));

Solution

1. Step 1: Understand wildcard origin allowance

   Using setAllowedOrigins(List.of("*")) is deprecated and may cause issues; instead, setAllowedOriginPatterns supports wildcards properly.

2. Step 2: Check allowed methods correctness

   Only GET and POST methods are allowed as required.

3. Final Answer:

   configuration.setAllowedOriginPatterns(List.of("*")); configuration.setAllowedMethods(List.of("GET", "POST")); -> Option A

4. Quick Check:

   Use allowedOriginPatterns for wildcard origins = A [OK]

Hint: Use setAllowedOriginPatterns for wildcard origins [OK]

Common Mistakes:

• Using setAllowedOrigins with "*" string
• Allowing extra HTTP methods by mistake
• Passing string instead of list to allowed origins